CVE-2025-28409

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.mdExploit, Third Party Advisory
https://github.com/yangzongzhuan/RuoYiProduct
https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.mdExploit, Third Party Advisory

Timeline

Published: Apr 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-28415.3The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through th CVE-2025-284109.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whethe CVE-2025-284119.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave CVE-2025-284129.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController CVE-2025-284139.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component CVE-2025-28424.3A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Ope CVE-2025-28438.8A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-S CVE-2025-28469.8A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects the function registra CVE-2025-28478.8A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown pro CVE-2025-28486.3A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non CVE-2025-28495.5A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of t CVE-2025-28503.5A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX18